Viewing Data Leak Protection status details

Information about the status of data leak protection is displayed in the Data Leak Prevention node of Management Console.

Details shown in the workspace of the Data Leak Prevention node are grouped into three sections:

• DLP Module status.
• Opened incidents.
• Statistics.

The DLP Module status section

The DLP Module status section provides information on the current status of the DLP Module and errors encountered during the operation of the DLP Module on Security Servers of your company. This section contains the following information:

• DLP Module status (Enabled; Enabled, running with errors; Disabled).
• Information on the following types of errors (if any):
  • Licensing errors
  • Errors associated with the DLP database
  • Message scan errors
  • Errors of connection with Security Servers with the DLP Module installed.

  The blocks with error details show the number and list of Security Servers where errors have occurred.

The Opened incidents section

The Opened incidents section lets you view statistics on currently existing incidents with New and In progress statuses.

The following information is displayed in the upper part of the section:

• Violators. The number of unique senders. Incidents generated while scanning messages of these senders, which currently have New or In progress status.
• New incidents. The number of currently existing incidents with New status.
• Incidents under processing. The number of currently existing incidents with In progress status.
• Opened high-priority incidents. The number of opened incidents (in percentage points) to which High priority has been assigned. This setting reflects the current severity level. The severity level can have the following values:
  • 0%-25%. Low. Highlighted in green.
  • 25%-50%. Medium. Highlighted in yellow.
  • 50%-75%. High. Highlighted in red.
  • 75%-100%. Critical. Highlighted in black.
• Top 3 violators. A list of three senders. Messages from these senders have violated the largest number of policies, and incidents generated as a result of policy violations by these messages have New or In progress status.

A chart showing the number of opened incidents with New and In progress status calculated for each category is displayed in the lower part of the section. Data belonging to all categories is included in the chart by default. You can modify the list of categories for which the chart of opened incidents is created.

To modify the list of categories for which the chart of opened incidents is created:

1. Click the Select categories button.

   The List of categories dialog will appear.

2. Select check boxes for the categories to be reflected in the chart of open incidents.
3. Click the OK button.

The chart content is refreshed according to the categories selected.

The Statistics Section

The Statistics section lets you obtain information about messages processed and scanned and on the number of incidents closed during the reporting period. The reporting period can be either 7 days or 30 days. You can select the reporting period by clicking the 7 days or 30 days links.

The upper part of the section contains the following information:

• Messages processed. Number of messages processed by the DLP Module.
• Messages scanned. Number of messages that fall into the scope of policies and have been scanned by the DLP Module.
• Incidents created. Number of incidents generated.
• Messages skipped due to timeouts. Number of messages that have not been scanned due to timeouts.
• Messages skipped due to errors. Number of messages that have not been scanned due to errors, including licensing errors.

The lower part of the section includes a chart of closed incidents showing the number and percentage of incidents with Closed (processed), Closed (false positive), Closed (not an incident), Closed (other) status, which were generated during the selected reporting period. Incidents restored from the archive are also reflected in the chart.

Incidents associated with all categories are included in the chart by default. You can modify the list of categories for which the chart of closed incidents is created.

To modify the list of categories for which the chart of closed incidents is created:

1. Click the Select categories button.

   The List of categories dialog will appear.

2. Select check boxes for the categories to be reflected in the chart of closed incidents.
3. Click the OK button.

The chart content is refreshed according to the categories selected.

Page top